v vanemmerik.ai / SUPPLY-CHAIN
vanemmerik.ai / supply-chain / 2026-08-04
Supply Chain · Watch Tuesday · 04 August 2026 End-of-day synthesis 3 watches · 37 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — A self-propagating npm worm tore through the keyv and cacheable namespaces the same day GHSA published Flowise's entire disclosure backlog — 23 CVEs — plus a fresh six-bug Open WebUI batch, making it open season on AI-agent tooling.

Today split into two stories that don't touch each other but rhyme: an active supply-chain worm spreading through the npm registry, and a security-research backlog landing on AI-agent-orchestration tooling in one coordinated dump.

The worm — Aikido ties it to the Shai-Hulud lineage, BleepingComputer calls it ChainDrop — compromised the keyv maintainer's GitHub account this morning and republished itself into downstream packages using stolen npm tokens, planting hooks aimed specifically at Claude Code and VS Code credentials; counts moved from 353 poisoned versions to 868+ packages by afternoon. Flowise absorbed 23 CVEs across two disclosure waves today — CSVAgent alone produced five independent RCE paths, and an unauthenticated OAuth2 credential-refresh endpoint leaked tokens twice, in two separate advisories. Open WebUI shipped six of its own in the same window, including an OAuth account-takeover bug, two stored-XSS paths, and two SSRF variants reaching internal services and cloud metadata, while CISA added three fresh KEV entries, including a third Langflow RCE catalogued in five weeks. The one bright spot: Socket's package scanning is now a one-click add inside AWS Security Hub, lowering the bar for orgs without supply-chain scanning wired into CI yet.

→ Operational priority for the night freeze keyv, cacheable, and their dependents, and audit for the planted Claude Code/VS Code hooks first; then pull CSVAgent and any public overrideConfig-reachable Flowise chatflows offline until every one of today's 23 patches is confirmed applied.

20:00 ET · First Watch
Critical · CISA KEV · N-able N-central · CVE-2026-18556 ·added 20:00 ET

CISA adds a second N-able N-central auth-bypass to KEV, a day after the related incomplete-patch CVE

CISA catalogued CVE-2026-18556 today, one day after adding CVE-2026-18577 — the flaw left behind by an incomplete patch for this same bug — on 08-03. N-central is an RMM platform MSPs use to manage client fleets, so an authentication bypass here is a direct pivot into every downstream customer network the RMM instance touches, the same blast-radius shape that made Kaseya notorious. Confirm you're on N-able's hotfix that covers both CVE-2026-18556 and -18577, not just the first; the due date is 2026-08-07.

Critical · CISA KEV · Apache Tomcat · CVE-2026-34486 ·added 20:00 ET

CISA adds Apache Tomcat EncryptInterceptor bypass to KEV

Tomcat's EncryptInterceptor exists to encrypt intra-cluster session-replication traffic; this flaw bypasses it, and CISA's KEV add confirms active exploitation. Any Tomcat cluster relying on EncryptInterceptor for session confidentiality should treat replication traffic as exposed on the wire until patched. Due date is 2026-08-07 — if replication traffic crosses an untrusted network segment, isolate it now rather than waiting for the patch window.

Critical · CISA KEV · IBM Langflow · CVE-2026-9198 ·added 20:00 ET

CISA adds Langflow unauthenticated RCE to KEV — third Langflow CVE catalogued in a month

Langflow's code-injection bug gives unauthenticated attackers full RCE on default deployments, and today's KEV add confirms it's being exploited in the wild. It's the third Langflow CVE added to KEV in five weeks — CVE-2026-0770 and CVE-2026-55255 both landed in early July — putting the low-code AI-agent-builder category through the same rough stretch Flowise is having today. If Langflow is reachable from the internet anywhere in your environment, patch immediately or take it offline; default deployments are exposed by design.

Critical · GHSA · FlowiseAI/Flowise ·added 20:00 ET

Flowise: a second unauthenticated OAuth2 endpoint returns access tokens directly to any caller

A second unauthenticated OAuth2 endpoint disclosed today: this one returns the refreshed access token straight in the response body to anyone who knows a credential ID, no session required. Combined with GHSA-r745's SSRF-via-refresh from earlier today, Flowise's OAuth2 credential-refresh surface has produced two independent unauthenticated token-theft paths in the same batch. Patch and rotate every OAuth2 credential configured in Flowise; assume both paths were exploitable in whatever version you're running until confirmed otherwise.

Critical · GHSA · FlowiseAI/Flowise ·added 20:00 ET

Flowise: CSVAgent RCE via prompt injection — no malicious file required

A prompt injection reaching the CSVAgent node is enough to trigger code execution on its own, no crafted CSV file needed. CSVAgent has now produced RCEs via malicious CSV payload, pandas pickle deserialization, a Unicode homoglyph sandbox bypass, and now prompt injection — four independent paths into the same node disclosed in one day. Disable CSVAgent everywhere it's reachable by untrusted input, including untrusted conversation text, not just untrusted files.

Critical · GHSA · FlowiseAI/Flowise ·added 20:00 ET

Flowise: fifth CSVAgent RCE — base64 segment of a csvFile data URI interpolated into Python source unvalidated

The base64 payload of a `csvFile` data URI is interpolated directly into generated Python source without validation, so a crafted data URI is arbitrary Python. Same node, yet another unvalidated-input-to-code-string pattern in a single day's disclosures — CSVAgent needs a rewrite, not a sixth patch. Treat any Flowise instance with CSVAgent enabled as compromised until you've confirmed the fix and rotated any credentials the Flowise host held.

Critical · GHSA · FlowiseAI/Flowise ·added 20:00 ET

Flowise: Pyodide validator Unicode homoglyph bypass restores sandbox-escape RCE

The Pyodide input validator can be defeated with Unicode homoglyphs — characters that look like blocked Python syntax without matching it byte-for-byte — undoing the protection the validator was meant to provide. Denylist-based sandboxing keeps failing the same way today: pandas `read_pickle` bypassed it this morning, homoglyphs bypass it now. Don't trust a denylist-based Flowise sandbox; wait for an isolate- or container-based rewrite before re-exposing these nodes to untrusted users.

High · GHSA · FlowiseAI/Flowise ·added 20:00 ET

Flowise: broken access control on Stripe subscription endpoints allows cross-tenant billing manipulation

Flowise's Stripe subscription endpoints don't verify the caller owns the subscription being modified, so one tenant can upgrade, downgrade, or cancel another tenant's plan. It's the same cross-tenant isolation failure recurring across today's disclosures — files, credentials, and now billing. Audit every endpoint that takes a subscription or customer ID as a parameter for the same missing ownership check.

High · GHSA · FlowiseAI/Flowise ·added 20:00 ET

Flowise: missing authorization on the execution-update endpoint

The execution-update endpoint accepts writes from any authenticated user regardless of workspace membership, letting a user tamper with another workspace's flow-execution records. Consistent with today's pattern: an auth check that exists at the session layer but not the resource-ownership layer. Confirm the patch adds workspace-scoped permission checks, not just a login requirement.

High · GHSA · FlowiseAI/Flowise ·added 20:00 ET

Flowise: cross-workspace OAuth2 credential metadata leak

Credential metadata — names, types, which services are configured — leaks across workspace boundaries, handing an attacker in one tenant a map of another tenant's OAuth2 integrations before they need it. Low severity on its own, but it's reconnaissance for the token-theft paths disclosed elsewhere in today's batch (GHSA-r745, GHSA-qgvm). Patch, and treat any cross-tenant workspace listing you can currently see as already leaked.

High · GHSA · FlowiseAI/Flowise ·added 20:00 ET

Flowise: GET /api/v1/upsert-history returns the entire server-wide ingestion history, unscoped

`GET /api/v1/upsert-history` returns every workspace's document-ingestion records to any authenticated caller — no workspace scoping at all. If your vector-store ingestion pipeline touches sensitive source documents, assume their metadata was visible to every other tenant on the instance. Patch and audit ingestion logs for cross-tenant access.

High · GHSA · FlowiseAI/Flowise ·added 20:00 ET

Flowise: cross-workspace credential IDOR in the openai-assistants-vector-store node

Same cross-workspace credential IDOR shape as elsewhere in today's batch, this time in the openai-assistants-vector-store node — a guessable credential ID from one workspace works against another. Rotate any OpenAI Assistants API credentials configured in a multi-tenant Flowise instance.

High · GHSA · FlowiseAI/Flowise ·added 20:00 ET

Flowise: authenticated arbitrary file write in the S3 Directory document loader via unsanitized S3 object key

The S3 Directory document loader doesn't sanitize the S3 object key before using it as a local filesystem path, so an authenticated user with S3-loader access can write files anywhere on the Flowise host — path traversal to arbitrary write. Paired with today's sandbox-escape RCEs, an attacker doesn't need a code-execution bug at all if they can drop a cron job or SSH key instead. Patch and audit S3 loader configs for object keys containing `../` sequences.

High · GHSA · FlowiseAI/Flowise ·added 20:00 ET

Flowise: RBAC bypass discloses workspace variables to lower-privileged users

An RBAC gap lets a lower-privileged user read workspace variables — the environment-variable-style config Flowise flows use, which commonly holds API keys and connection strings. Treat every workspace variable in a multi-tenant instance as exposed to any authenticated user until patched, and rotate secrets stored there.

High · GHSA · FlowiseAI/Flowise ·added 20:00 ET

Flowise: CVE-2025-8943 patch bypass — npm_config_yes evades the MCP environment-variable blocklist

Last year's fix for CVE-2025-8943 blocked a set of dangerous MCP environment variables but missed `npm_config_yes`, which npx honors to skip its install-confirmation prompt — turning an MCP tool config into unattended arbitrary package execution. Blocklist bypasses via undocumented aliases are a recurring failure mode; if you maintain a similar environment-variable blocklist anywhere, check it against every alias and legacy variable a tool respects, not just the documented ones.

High · GHSA · FlowiseAI/Flowise ·added 20:00 ET

Flowise: DELETE /api/v1/chatflows/:id doesn't validate resource type, letting chatflows:delete reach agentflows

The chatflow-delete endpoint doesn't check whether the target ID actually belongs to a chatflow or an agentflow, so a user holding only `chatflows:delete` permission can delete agentflows too — a permission check confusing resource type for capability. Audit any RBAC-gated delete endpoint built on Flowise's permission model for the same type-confusion pattern.

High · GHSA · open-webui/open-webui ·added 20:00 ET

Open WebUI: account takeover via OAuth token exchange accepting tokens issued to any client

Open WebUI's OAuth token exchange accepts any valid token regardless of which client it was originally issued to — a missing audience/client-ID check means a token obtained for an unrelated OAuth client can be exchanged for a session on someone else's Open WebUI account. Of the six Open WebUI advisories in today's batch, this is the most direct account-takeover path; patch this one first if you run Open WebUI with OAuth login enabled.

High · GHSA · open-webui/open-webui ·added 20:00 ET

Open WebUI: stored XSS via unescaped KaTeX render-error fallback in rendered messages

When KaTeX fails to render a math expression, its error fallback renders unescaped, so a crafted expression embedded in a message becomes stored XSS that fires for anyone who later views it — including via AI-generated responses that echo user input back into the chat. Stored XSS in a chat UI is a session-hijacking vector for every user who opens the affected conversation; patch and treat any account that viewed a suspicious message as potentially compromised.

High · GHSA · open-webui/open-webui ·added 20:00 ET

Open WebUI: same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin

The terminal feature's file-preview iframe hardcodes `allow-same-origin` in its sandbox attribute, so a previewed file can execute script with full access to the parent page's session — same-origin XSS straight to account takeover. `allow-same-origin` on an iframe that renders any attacker-influenceable content defeats the sandbox entirely; grep your own iframe usage for the same combination if you preview user-supplied files anywhere.

High · GHSA · open-webui/open-webui ·added 20:00 ET

Open WebUI: any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

Open WebUI's URL-fetching feature doesn't account for NAT64/DNS64 address encoding, so a hostname that resolves through a NAT64 gateway reaches RFC1918 internal addresses and cloud metadata endpoints that a naive IP-literal SSRF filter would otherwise block — and any authenticated user can trigger it, not just admins. Audit your own SSRF filters for NAT64 encoding if they only check literal IPv4/IPv6 ranges.

High · GHSA · open-webui/open-webui ·added 20:00 ET

Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

The Playwright-based web loader fetches sub-resources — images, scripts, stylesheets — referenced by a loaded page without validating their targets, so a malicious page can pull the loader into fetching internal services as a side effect of rendering. Third SSRF-adjacent issue in Open WebUI's fetch surface disclosed today, alongside the NAT64 bypass above; if you let Open WebUI load arbitrary URLs, isolate its network egress rather than relying on app-layer filters alone.

High · GHSA · open-webui/open-webui ·added 20:00 ET

Open WebUI: a folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder

A write-collaborator on a shared folder can delete the folder outright and take the owner's chats with it — a permission meant for editing content extends to permanently destroying it. If you use Open WebUI's folder-sharing feature, treat any 'write' collaborator as having delete power over your chat history until this is patched.

High · GHSA · TryGhost/Ghost ·added 20:00 ET

Ghost: XSS in the ActivityPub (Fediverse) client via unsanitized federated content

Ghost's ActivityPub client doesn't sanitize incoming federated content before rendering it, so a malicious remote server or account can deliver stored XSS to any Ghost instance that follows or interacts with it. ActivityPub federation inherently means rendering content from untrusted remote servers — treat XSS in the federation-rendering path as high priority regardless of CVSS. Patch before enabling or continuing federation on any Ghost site handling sensitive sessions.

Medium · Socket ·added 20:00 ET

Socket joins the AWS Security Hub Extended plan

Socket's package-scanning is now adoptable through AWS Security Hub's Extended plan, billed against committed AWS spend rather than a separate procurement process. Modest, but it lowers the friction for supply-chain scanning inside AWS-centric orgs — on a day when both the keyv npm worm and a fresh KEV backfill make the case for having that scanning already in place.

12:00 ET · Forenoon Watch
Critical · Socket · also Aikido (Shai-Hulud lineage), BleepingComputer ("ChainDrop"), The Hacker News ·added 12:00 ET

Active supply-chain worm compromises keyv, cacheable and hundreds of downstream npm packages

An attacker compromised the keyv maintainer's GitHub account and pushed a self-propagating worm — Aikido ties it to the Shai-Hulud lineage, BleepingComputer calls it ChainDrop — starting with [email protected] and eight related Cacheable-namespace packages, then republishing itself into every downstream package it can reach using stolen npm tokens. Counts are moving fast: SafeDep had 353 poisoned versions across 79 names this morning, Aikido's later count is 868+ packages with a combined multi-billion download footprint, and Hacker News reports the payload specifically plants hooks into Claude Code and VS Code — it's after developer-tooling credentials, not just runtime secrets. Freeze/pin keyv, cacheable and anything that depends on them today, audit CI postinstall network activity in the last 24 hours, and rotate npm publish tokens and IDE credentials on any box that installed the affected versions.

Critical · GHSA · FlowiseAI/Flowise · CVE-2026-69255 ·added 12:00 ET

Flowise CSV Agent RCE — Metasploit module gets root shell via Pyodide-to-Node bridge

The first of six Flowise RCE advisories GHSA published in one batch today: the CSVAgent node's Python sandbox lets a base64-encoded CSV payload reach Pyodide's `js` bridge, load Node's `child_process` around the ESM require restriction, and `execSync` arbitrary commands as root — the report ships a working Metasploit module with a confirmed Meterpreter session. Flowise is a popular low-code platform for building agentic AI apps, so a pre-auth-adjacent RCE in a stock node is a direct path into whatever credentials and internal network access the Flowise host holds. Patch to the fixed release immediately, and if you can't patch today pull public CSVAgent-enabled chatflows offline.

Critical · GHSA · FlowiseAI/Flowise · CVE-2026-69256 ·added 12:00 ET

Flowise CSVAgent RCE via pandas read_pickle bypassing the Python code denylist

Second CSVAgent RCE in today's batch, same node as GHSA-vmv7 but a different bypass: the denylist that blocks dangerous Python constructs doesn't catch pandas' `read_pickle()`, which deserialises attacker-controlled pickle data into arbitrary code execution inside the Pyodide sandbox. Two independent RCE paths through the same node in one disclosure means CSVAgent's sandboxing model itself is the problem, not a single missed pattern — treat the whole node as untrusted until Flowise redesigns it. Disable CSVAgent for public/multi-tenant chatflows until you've confirmed the patched version closes both paths.

Critical · GHSA · FlowiseAI/Flowise · CVE-2026-69254 ·added 12:00 ET

Flowise NodeVM sandbox escape lets any authenticated user get root RCE via nodeVMOptions override

Third critical in today's Flowise batch: `executeJavaScriptCode()` spreads caller-supplied `nodeVMOptions` over the secure defaults, so any authenticated user can re-enable `child_process` and `fs` in the Custom Function node's sandbox and run arbitrary commands as root. This is a classic trust-the-options-object bug — the same shape as prototype-pollution-via-merge, just in a security-config object instead of app state; grep any code that spreads user input into a security-relevant options object for the same pattern. Patch immediately; this needs only an authenticated (not admin) account, so it's reachable by any Flowise tenant user.

Critical · GHSA · FlowiseAI/Flowise, FlowiseAI/nodevm · elttam ·added 12:00 ET

Flowise JavaScript sandbox escape to RCE via the vm2-derived nodevm fork — still unpatched on main at time of writing

Fourth critical: the Custom Function/Custom Tool sandbox is backed by `patriksimek/vm2` (forked and maintained as FlowiseAI/nodevm), and elttam's escape still worked against the latest main-branch commit at time of writing — the original report was closed on a misunderstanding that it was just about an outdated vm2 version. vm2-family sandbox escapes are a recurring category; if you're running any product that vendors a vm2 fork rather than a maintained isolate-based sandbox, assume it's escapable and treat it as a security boundary of last resort, not a real one. Don't expose Custom Function/Custom Tool nodes to untrusted users until FlowiseAI ships a real fix, not just a patch to this specific escape.

Critical · GHSA · FlowiseAI/Flowise · CVE-2026-69259 ·added 12:00 ET

Flowise RCE via SQLite Record Manager node's overridable database path

Fifth critical: the SQLite Record Manager node lets `additionalConfig` override the database path outright, which chains into code execution on the Flowise host. Same root-cause shape as the TypeORM DataSource RCE below (GHSA-g32j): both let `additionalConfig` pass unvalidated options straight into a data-layer constructor. Any node that accepts `additionalConfig` for a database connector should be audited for the same unchecked-passthrough pattern, not just these two.

Critical · GHSA · FlowiseAI/Flowise · CVE-2026-69251 ·added 12:00 ET

Flowise RCE via TypeORM DataSource — MySQL/Postgres Record Manager nodes accept arbitrary connection options

Sixth and last critical in today's Flowise batch: the MySQL and other RecordManager nodes let `additionalConfig` set arbitrary TypeORM `DataSource` options, which TypeORM will turn into code execution via driver-level options — the same class of bug as the SQLite variant above. Six critical RCEs in one vendor's advisory batch in a single day is a strong signal the whole `additionalConfig` passthrough pattern needs a security review, not node-by-node patching. If you self-host Flowise, patch now and specifically audit every node that exposes `additionalConfig` for the same unvalidated-passthrough shape.

High · GHSA · FlowiseAI/Flowise · CVE-2026-69258 ·added 12:00 ET

Flowise: unauthenticated overrideConfig injection into flow execution context bypasses an earlier fix

The public, unauthenticated `/api/v1/prediction/:id` endpoint spreads a caller-supplied `overrideConfig` object straight into the flow execution context in two code paths that weren't covered by the earlier GHSA-5cph fix, enabling session hijacking, chat-history manipulation and injected `$flow.*` template values on any public chatflow. It's the second time this overrideConfig surface has needed patching — treat any 'fixed' overrideConfig-adjacent code path as suspect until Flowise gates every spread operation behind `apiOverrideStatus`, not just the ones already reported. Confirm your patched version closes both the old and new spread sites, not just the CVE number.

High · GHSA · FlowiseAI/Flowise · CVE-2026-69257 ·added 12:00 ET

Flowise SSRF protection bypass via IPv4-mapped IPv6 addresses reaches cloud metadata

Flowise's SSRF deny-list checks IP `kind()` via ipaddr.js but never normalizes IPv4-mapped IPv6 addresses first, so an attacker-controlled AAAA record pointing at `::ffff:169.254.169.254` sails past every IPv4 CIDR block and reaches cloud metadata endpoints and internal services. This is a known bug class — if your own services validate SSRF targets with ipaddr.js or similar, check whether you normalize mapped addresses before the deny-list check. Affects versions through 3.1.1, including hosts that thought they'd already patched the earlier SSRF CVE-2026-31829 — verify the fix covers this specific bypass.

High · GHSA · FlowiseAI/Flowise · CVE-2026-69252 ·added 12:00 ET

Flowise: any API key can list and delete files across workspaces in the same organization

The `/api/v1/files` route checks only a feature-plan gate, not per-workspace permissions, so an API key scoped to unrelated permissions in one workspace can list and delete files belonging to every other workspace in the same org. Multi-tenant Flowise deployments should treat this as a workspace-isolation failure, not just a files bug — audit whether other endpoints use the same organization-only scoping instead of workspace-level checks. Rotate any API keys that might have been over-scoped and confirm the patch adds workspace-level `checkPermission` to both GET and DELETE.

High · GHSA · FlowiseAI/Flowise · CVE-2026-69250 ·added 12:00 ET

Flowise: unauthenticated OAuth2 token-refresh endpoint is a non-blind SSRF that echoes secrets back to the caller

`/api/v1/oauth2-credential/refresh/:credentialId` is whitelisted as unauthenticated by design, makes a server-side POST to a credential-controlled `accessTokenUrl`, and reflects the full response body back to the caller — confirmed non-blind SSRF plus secret exfiltration, no auth required. Whitelisting a route because it 'has to be' unauthenticated (OAuth callbacks/refreshes often do) is a recurring trap; a whitelisted route no longer inherits the app's auth-gated protections, so it needs its own SSRF/target validation. Treat any credential that ever hit this endpoint as potentially exposed and rotate it.

Medium · GHSA · FlowiseAI/Flowise (cloud.flowiseai.com) ·added 12:00 ET

Flowise cloud: IDOR on customer-default-source endpoint exposes other customers' billing data

`GET /api/v1/organization/customer-default-source?customerId=...` checks for a valid session but never verifies the caller owns that `customerId`, so a predictable Stripe-formatted ID lets any authenticated user pull another customer's email, account balance, currency and billing config. Predictable IDs plus session-only checks is the textbook IDOR shape — audit any endpoint that takes a Stripe or other vendor-formatted ID as a URL parameter for the same missing ownership check. Affects the hosted cloud.flowiseai.com product specifically, not just self-hosted deployments.

06:00 ET · Morning Watch
Context · Pipeline · fetchers (GHSA 0 new/29 dupes · KEV 0 new/26 in window · RSS 0 new/2 dupes) ·added 06:00 ET

Morning Watch: everything in the fetch window was already triaged on 2026-08-03

The Morning fetchers turned up nothing genuinely new: all 29 unique GHSA advisories in the 26-hour window (the Guzzle/ip-address/fast-uri host-parsing trio, the Angular quartet, the undici batch, Sequelize's CVSS 9.8 Oracle-dialect SQLi, GitPython's audited call sites) are the same set the 2026-08-03 Forenoon Watch already triaged. CISA KEV added zero new entries since the N-able N-central auth bypass on 08-03 — the 30-day backfill window is unchanged. Both RSS hits are re-syndication of yesterday's stories: The Hacker News' writeup on the 18-package Alibaba RAT campaign is the same Socket disclosure covered as the 08-03 story-of-the-day, and BleepingComputer's fake Xeno Roblox launcher piece was already triaged yesterday too. Retained as the pipeline-state record for the morning; nothing here needs action beyond what 08-03's Last Watch already flagged.